CVE-2026-42826

The vulnerability classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) involves improper access control to protected resources or data in the Azure DevOps service. An attacker without any permissions can send a specially crafted request over the network and gain access to information that should be available only to authorized users. The vulnerability does not require user interaction, and its scope extends beyond the originally attacked component (Scope: Changed).

An attacker can remotely and without authentication disclose sensitive information stored or processed by Azure DevOps, which may include project data, source code, pipeline configurations, tokens, or other confidential organizational resources. Leakage of such data may lead to further attacks on IT infrastructure.

Patches available from the vendor should be applied according to references — details regarding updates are published in the Microsoft Security Response Center at: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42826

Microsoft Azure DevOps — versions indicated in vendor references (Microsoft Security Response Center)